skill.md still rejects Homebrew python@3.x shebang (@ allowlist) — incomplete fix vs #473 / #1392

[SUDARSHANCHAUDHARI]

graphify: v0.9.4 (branch v8) · macOS · graphify installed into Homebrew Python (/opt/homebrew/opt/python@3.13/bin/python3.13), not uv tool

Summary

The generated Claude Code skill resolves the Python interpreter to bare python3 (Xcode Command Line Tools), which lacks graphify, so every step fails with ModuleNotFoundError: graphify. Root cause is the @-rejecting allowlist at graphify/skill.md:80 and :632:

case "$_SHEBANG" in
    *[!a-zA-Z0-9/_.-]*) ;;      # rejects /opt/homebrew/opt/python@3.13/...
    *) "$_SHEBANG" -c "import graphify" 2>/dev/null && PYTHON="$_SHEBANG" ;;
esac

Homebrew installs versioned Python under python@3.13, so the interpreter shebang legitimately contains @. The guard treats @ as unsafe, skips the valid interpreter, and falls through to python3.

Why the existing fixes don't cover this

• macOS: git hooks reject Homebrew python@3.11 shebang paths and silently skip graph rebuilds #473 fixed the same @ allowlist, but only in graphify/hooks.py (_PYTHON_DETECT) — the skill template was not updated.
• graphify claude install (v0.8.41): 26 validated bugs in the generated Claude Code skill (interpreter, --directed, shrink-guard, cleanup ordering) #1392 (item A.1) added the uv-first + import graphify recovery now at skill.md:73 / :86-89. That recovery only rescues when uv tool run graphifyy python resolves. For a Homebrew-pip install it returns empty, detection falls to python3, and the run fails.

So this is an incomplete-fix / gap rather than a fresh discovery: the @ allowlist was fixed for hooks (#473) but the same pattern still ships in the skill template in v0.9.4.

Repro

1. "$(brew --prefix python@3.13)/bin/python3.13" -m pip install graphifyy (so which graphify's shebang contains @)
2. Run /graphify . in Claude Code
3. Step 1 writes python3 into graphify-out/.graphify_python; all subsequent steps fail with ModuleNotFoundError: graphify

Fix

Allow @ in both guards (skill.md:80, :632), matching the intent of #473:

-        *[!a-zA-Z0-9/_.-]*) ;;
+        *[!a-zA-Z0-9/_.@-]*) ;;

-        case "$PYTHON" in *[!a-zA-Z0-9/_.-]*) PYTHON="python3" ;; esac
+        case "$PYTHON" in *[!a-zA-Z0-9/_.@-]*) PYTHON="python3" ;; esac

Verified locally: after this change detection resolves to /opt/homebrew/opt/python@3.13/bin/python3.13 and import graphify succeeds. The root fix belongs in the skill generator/template so it isn't regenerated away on the next graphify claude install. @ is safe in a filesystem path used only as an exec target.

[safishamsi]

Fixed on v8 (b70a6d7). The @ is now allowed in the interpreter-detection allowlist across all skill variants (fixed in the skillgen source fragments and regenerated), matching the #473 hooks.py fix. Verified the shell logic accepts /opt/homebrew/opt/python@3.13/bin/python3.13 while still rejecting injection like ; rm -rf / and $(evil). Registered as a sanctioned skillgen monolith diff; all skillgen guards + 57 skillgen tests green. Ships next release. Thanks for the precise diagnosis and the diff.

[safishamsi]

Shipped in 0.9.5 (pip install -U graphifyy==0.9.5). Closing.